Welcome to our website
To take full advantage of all features you need to login or register. Registration is completely free and takes only a few seconds.
GLSA 200403-12: OpenLDAP DoS Vulnerability
Posted by Philipp Esselbach on: 03/31/2004 07:01 AM [ Print | 0 comment(s) ]
An OpenLDAP updated has been released for Gentoo Linux
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200403-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: OpenLDAP DoS Vulnerability
Date: March 31, 2004
Bugs: #26728
ID: 200403-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
=======
A failed password operation can cause the OpenLDAP slapd server, if it is using the back-ldbm backend, to free memory that was never allocated.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200403-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: OpenLDAP DoS Vulnerability
Date: March 31, 2004
Bugs: #26728
ID: 200403-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
=======
A failed password operation can cause the OpenLDAP slapd server, if it is using the back-ldbm backend, to free memory that was never allocated.
Background
=========
OpenLDAP is a suite of LDAP-related application and development tools. It includes slapd (the standalone LDAP server), slurpd (the standalone LDAP replication server), and various LDAP libraries, utilities and example clients.
Affected packages
================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
net-nds/openldap <= 2.1.12 >= 2.1.13
Description
==========
A password extended operation (password EXOP) which fails will cause the slapd server to free() an uninitialized pointer, possibly resulting in a segfault. This only affects servers using the back-ldbm backend.
Such a crash is not guaranteed with every failed operation, however, it is possible.
Impact
=====
An attacker (or indeed, a normal user) may crash the OpenLDAP server, creating a Denial of Service condition.
Workaround
=========
A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.
Resolution
=========
OpenLDAP users should upgrade to version 2.1.13 or later:
# emerge sync
# emerge -pv ">=net-nds/openldap-2.1.13"
# emerge ">=net-nds/openldap-2.1.13"
References
=========
[ 1 ] http://www.openldap.org/its/index.cgi?findid=2390
Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
=========
OpenLDAP is a suite of LDAP-related application and development tools. It includes slapd (the standalone LDAP server), slurpd (the standalone LDAP replication server), and various LDAP libraries, utilities and example clients.
Affected packages
================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
net-nds/openldap <= 2.1.12 >= 2.1.13
Description
==========
A password extended operation (password EXOP) which fails will cause the slapd server to free() an uninitialized pointer, possibly resulting in a segfault. This only affects servers using the back-ldbm backend.
Such a crash is not guaranteed with every failed operation, however, it is possible.
Impact
=====
An attacker (or indeed, a normal user) may crash the OpenLDAP server, creating a Denial of Service condition.
Workaround
=========
A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.
Resolution
=========
OpenLDAP users should upgrade to version 2.1.13 or later:
# emerge sync
# emerge -pv ">=net-nds/openldap-2.1.13"
# emerge ">=net-nds/openldap-2.1.13"
References
=========
[ 1 ] http://www.openldap.org/its/index.cgi?findid=2390
Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
